~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_AUDIT.c

Version: ~ [ linux-5.13-rc2 ] ~ [ linux-5.12.4 ] ~ [ linux-5.11.21 ] ~ [ linux-5.10.37 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.119 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.190 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.232 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.268 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.268 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Creates audit record for dropped/accepted packets
  3  *
  4  * (C) 2010-2011 Thomas Graf <tgraf@redhat.com>
  5  * (C) 2010-2011 Red Hat, Inc.
  6  *
  7  * This program is free software; you can redistribute it and/or modify
  8  * it under the terms of the GNU General Public License version 2 as
  9  * published by the Free Software Foundation.
 10 */
 11 
 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 13 
 14 #include <linux/audit.h>
 15 #include <linux/module.h>
 16 #include <linux/skbuff.h>
 17 #include <linux/tcp.h>
 18 #include <linux/udp.h>
 19 #include <linux/if_arp.h>
 20 #include <linux/netfilter/x_tables.h>
 21 #include <linux/netfilter/xt_AUDIT.h>
 22 #include <linux/netfilter_bridge/ebtables.h>
 23 #include <net/ipv6.h>
 24 #include <net/ip.h>
 25 
 26 MODULE_LICENSE("GPL");
 27 MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>");
 28 MODULE_DESCRIPTION("Xtables: creates audit records for dropped/accepted packets");
 29 MODULE_ALIAS("ipt_AUDIT");
 30 MODULE_ALIAS("ip6t_AUDIT");
 31 MODULE_ALIAS("ebt_AUDIT");
 32 MODULE_ALIAS("arpt_AUDIT");
 33 
 34 static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
 35 {
 36         struct iphdr _iph;
 37         const struct iphdr *ih;
 38 
 39         ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
 40         if (!ih)
 41                 return false;
 42 
 43         audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
 44                          &ih->saddr, &ih->daddr, ih->protocol);
 45 
 46         return true;
 47 }
 48 
 49 static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
 50 {
 51         struct ipv6hdr _ip6h;
 52         const struct ipv6hdr *ih;
 53         u8 nexthdr;
 54         __be16 frag_off;
 55 
 56         ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
 57         if (!ih)
 58                 return false;
 59 
 60         nexthdr = ih->nexthdr;
 61         ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
 62 
 63         audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
 64                          &ih->saddr, &ih->daddr, nexthdr);
 65 
 66         return true;
 67 }
 68 
 69 static unsigned int
 70 audit_tg(struct sk_buff *skb, const struct xt_action_param *par)
 71 {
 72         struct audit_buffer *ab;
 73         int fam = -1;
 74 
 75         if (audit_enabled == 0)
 76                 goto errout;
 77         ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT);
 78         if (ab == NULL)
 79                 goto errout;
 80 
 81         audit_log_format(ab, "mark=%#x", skb->mark);
 82 
 83         switch (xt_family(par)) {
 84         case NFPROTO_BRIDGE:
 85                 switch (eth_hdr(skb)->h_proto) {
 86                 case htons(ETH_P_IP):
 87                         fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
 88                         break;
 89                 case htons(ETH_P_IPV6):
 90                         fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
 91                         break;
 92                 }
 93                 break;
 94         case NFPROTO_IPV4:
 95                 fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
 96                 break;
 97         case NFPROTO_IPV6:
 98                 fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
 99                 break;
100         }
101 
102         if (fam == -1)
103                 audit_log_format(ab, " saddr=? daddr=? proto=-1");
104 
105         audit_log_end(ab);
106 
107 errout:
108         return XT_CONTINUE;
109 }
110 
111 static unsigned int
112 audit_tg_ebt(struct sk_buff *skb, const struct xt_action_param *par)
113 {
114         audit_tg(skb, par);
115         return EBT_CONTINUE;
116 }
117 
118 static int audit_tg_check(const struct xt_tgchk_param *par)
119 {
120         const struct xt_audit_info *info = par->targinfo;
121 
122         if (info->type > XT_AUDIT_TYPE_MAX) {
123                 pr_info("Audit type out of range (valid range: 0..%hhu)\n",
124                         XT_AUDIT_TYPE_MAX);
125                 return -ERANGE;
126         }
127 
128         return 0;
129 }
130 
131 static struct xt_target audit_tg_reg[] __read_mostly = {
132         {
133                 .name           = "AUDIT",
134                 .family         = NFPROTO_UNSPEC,
135                 .target         = audit_tg,
136                 .targetsize     = sizeof(struct xt_audit_info),
137                 .checkentry     = audit_tg_check,
138                 .me             = THIS_MODULE,
139         },
140         {
141                 .name           = "AUDIT",
142                 .family         = NFPROTO_BRIDGE,
143                 .target         = audit_tg_ebt,
144                 .targetsize     = sizeof(struct xt_audit_info),
145                 .checkentry     = audit_tg_check,
146                 .me             = THIS_MODULE,
147         },
148 };
149 
150 static int __init audit_tg_init(void)
151 {
152         return xt_register_targets(audit_tg_reg, ARRAY_SIZE(audit_tg_reg));
153 }
154 
155 static void __exit audit_tg_exit(void)
156 {
157         xt_unregister_targets(audit_tg_reg, ARRAY_SIZE(audit_tg_reg));
158 }
159 
160 module_init(audit_tg_init);
161 module_exit(audit_tg_exit);
162 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp